Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
hast-util-select
Advanced tools
hast utility with equivalents for querySelector
, querySelectorAll
,
and matches
.
This package lets you find nodes in a tree, similar to how querySelector
,
querySelectorAll
, and matches
work with the DOM.
One notable difference between DOM and hast is that DOM nodes have references
to their parents, meaning that document.body.matches(':last-child')
can
be evaluated to check whether the body is the last child of its parent.
This information is not stored in hast, so selectors like that don’t work.
This is a small utility that is quite useful, but is rather slow if you use it a
lot.
For each call, it has to walk the entire tree.
In some cases, walking the tree once with unist-util-visit
is smarter, such as when you want to change certain nodes.
On the other hand, this is quite powerful and fast enough for many other cases.
This utility is similar to unist-util-select
, which can
find and match any unist node.
This package is ESM only. In Node.js (version 14.14+ and 16.0+), install with npm:
npm install hast-util-select
In Deno with esm.sh
:
import {matches, select, selectAll} from "https://esm.sh/hast-util-select@5"
In browsers with esm.sh
:
<script type="module">
import {matches, select, selectAll} from "https://esm.sh/hast-util-select@5?bundle"
</script>
import {h} from 'hastscript'
import {matches, select, selectAll} from 'hast-util-select'
const tree = h('section', [
h('p', 'Alpha'),
h('p', 'Bravo'),
h('h1', 'Charlie'),
h('p', 'Delta'),
h('p', 'Echo'),
h('p', 'Foxtrot'),
h('p', 'Golf')
])
matches('section', tree) // `true`
console.log(select('h1 ~ :nth-child(even)', tree))
// The paragraph with `Delta`
console.log(selectAll('h1 ~ :nth-child(even)', tree))
// The paragraphs with `Delta` and `Foxtrot`
This package exports the identifiers matches
, select
,
and selectAll
.
There is no default export.
matches(selector, node[, space])
Check that the given node
matches selector
.
This only checks the element itself, not the surrounding tree.
Thus, nesting in selectors is not supported (p b
, p > b
), neither are
selectors like :first-child
, etc.
This only checks that the given element matches the selector.
selector
(string
)
— CSS selector, such as (h1
, a, b
)node
(Node
, optional)
— node that might match selector
, should be an elementspace
(Space
, default: 'html'
)
— name of namespaceWhether node
matches selector
(boolean
).
import {h} from 'hastscript'
import {matches} from 'hast-util-select'
matches('b, i', h('b')) // => true
matches(':any-link', h('a')) // => false
matches(':any-link', h('a', {href: '#'})) // => true
matches('.classy', h('a', {className: ['classy']})) // => true
matches('#id', h('a', {id: 'id'})) // => true
matches('[lang|=en]', h('a', {lang: 'en'})) // => true
matches('[lang|=en]', h('a', {lang: 'en-GB'})) // => true
select(selector, tree[, space])
Select the first element that matches selector
in the given tree
.
Searches the tree in preorder.
selector
(string
)
— CSS selector, such as (h1
, a, b
)tree
(Node
, optional)
— tree to searchspace
(Space
, default: 'html'
)
— name of namespaceFirst element in tree
that matches selector
or null
if nothing is found.
This could be tree
itself.
import {h} from 'hastscript'
import {select} from 'hast-util-select'
console.log(
select(
'h1 ~ :nth-child(even)',
h('section', [
h('p', 'Alpha'),
h('p', 'Bravo'),
h('h1', 'Charlie'),
h('p', 'Delta'),
h('p', 'Echo')
])
)
)
Yields:
{ type: 'element',
tagName: 'p',
properties: {},
children: [ { type: 'text', value: 'Delta' } ] }
selectAll(selector, tree[, space])
Select all elements that match selector
in the given tree
.
Searches the tree in preorder.
selector
(string
)
— CSS selector, such as (h1
, a, b
)tree
(Node
, optional)
— tree to searchspace
(Space
, default: 'html'
)
— name of namespaceElements in tree
that match selector
.
This could include tree
itself.
import {h} from 'hastscript'
import {selectAll} from 'hast-util-select'
console.log(
selectAll(
'h1 ~ :nth-child(even)',
h('section', [
h('p', 'Alpha'),
h('p', 'Bravo'),
h('h1', 'Charlie'),
h('p', 'Delta'),
h('p', 'Echo'),
h('p', 'Foxtrot'),
h('p', 'Golf')
])
)
)
Yields:
[ { type: 'element',
tagName: 'p',
properties: {},
children: [ { type: 'text', value: 'Delta' } ] },
{ type: 'element',
tagName: 'p',
properties: {},
children: [ { type: 'text', value: 'Foxtrot' } ] } ]
Space
Namespace (TypeScript type).
type Space = 'html' | 'svg'
*
(universal selector),
(multiple selector)p
(type selector).class
(class selector)#id
(id selector)article p
(combinator: descendant selector)article > p
(combinator: child selector)h1 + p
(combinator: next-sibling selector)h1 ~ p
(combinator: subsequent sibling selector)[attr]
(attribute existence)[attr=value]
(attribute equality)[attr~=value]
(attribute contains in space-separated list)[attr|=value]
(attribute equality or prefix)[attr^=value]
(attribute begins with)[attr$=value]
(attribute ends with)[attr*=value]
(attribute contains):any()
(functional pseudo-class, use :matches
instead):dir()
(functional pseudo-class):has()
(functional pseudo-class):lang()
(functional pseudo-class):matches()
(functional pseudo-class):not()
(functional pseudo-class):any-link
(pseudo-class):blank
(pseudo-class):checked
(pseudo-class):disabled
(pseudo-class):empty
(pseudo-class):enabled
(pseudo-class):optional
(pseudo-class):read-only
(pseudo-class):read-write
(pseudo-class):required
(pseudo-class):root
(pseudo-class):scope
(pseudo-class)::first-child
(pseudo-class):first-of-type
(pseudo-class):last-child
(pseudo-class):last-of-type
(pseudo-class):only-child
(pseudo-class):only-of-type
(pseudo-class):nth-child()
(functional pseudo-class):nth-last-child()
(functional pseudo-class):nth-last-of-type()
(functional pseudo-class):nth-of-type()
(functional pseudo-class)||
(column combinator)ns|E
(namespace type selector)*|E
(any namespace type selector)|E
(no namespace type selector)[ns|attr]
(namespace attribute)[*|attr]
(any namespace attribute)[|attr]
(no namespace attribute)[attr=value i]
(attribute case-insensitive):has()
(functional pseudo-class, note: relative selectors such as
:has(> img)
are not supported, but scope is: :has(:scope > img)
):nth-child(n of S)
(functional pseudo-class, note: scoping to
parents is not supported):nth-last-child(n of S)
(functional pseudo-class, note: scoping to
parents is not supported):active
(pseudo-class):current
(pseudo-class):current()
(functional pseudo-class):default
(pseudo-class):defined
(pseudo-class):drop
(pseudo-class):drop()
(functional pseudo-class):focus
(pseudo-class):focus-visible
(pseudo-class):focus-within
(pseudo-class):fullscreen
(pseudo-class):future
(pseudo-class):host()
(functional pseudo-class):host-context()
(functional pseudo-class):hover
(pseudo-class):in-range
(pseudo-class):indeterminate
(pseudo-class):invalid
(pseudo-class):link
(pseudo-class):local-link
(pseudo-class):nth-column()
(functional pseudo-class):nth-last-column()
(functional pseudo-class):out-of-range
(pseudo-class):past
(pseudo-class):paused
(pseudo-class):placeholder-shown
(pseudo-class):playing
(pseudo-class):something()
(functional pseudo-class):target
(pseudo-class):target-within
(pseudo-class):user-error
(pseudo-class):user-invalid
(pseudo-class):valid
(pseudo-class):visited
(pseudo-class)::before
(pseudo-elements: none are supported)matches
This package is fully typed with TypeScript.
It exports the additional type Space
.
Projects maintained by the unified collective are compatible with all maintained versions of Node.js. As of now, that is Node.js 14.14+ and 16.0+. Our projects sometimes work with older versions, but this is not guaranteed.
This package does not change the syntax tree so there are no openings for cross-site scripting (XSS) attacks.
unist-util-select
— select unist nodes with CSS-like selectorshast-util-find-and-replace
— find and replace text in a hast treehast-util-parse-selector
— create an element from a simple CSS selectorhast-util-from-selector
— create an element from a complex CSS selectorSee contributing.md
in syntax-tree/.github
for
ways to get started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
FAQs
hast utility for `querySelector`, `querySelectorAll`, and `matches`
The npm package hast-util-select receives a total of 286,871 weekly downloads. As such, hast-util-select popularity was classified as popular.
We found that hast-util-select demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.